Analysts at Elliptic reported that the North Korean hacker group Lazarus has again begun using the US-sanctioned cryptocurrency mixer Tornado Cash to cover the traces of its transactions.

Researchers found that over the past three days, Lazarus members transferred $12 million worth of ether through Tornado Cash. These funds were stolen in November 2023 during a hack of the HTX crypto exchange and its HTX Eco Chain (HECO) gateway bridge. During the attack, the attackers managed to empty the platform’s hot wallets for $30 million; on the same day, $86.6 million worth of crypto assets were stolen from HECO.

The assets recently began to move for the first time after the incident and were transferred through Tornado Cash in 40 transactions. Earlier this year, another hacker who hacked the Raydium protocol was also able to send 1774.5 stolen ethers to the Tornado Cash mixer.

“Tornado Cash continues to operate despite the sanctions. The mixer operates using smart contracts running on decentralized blockchains, so the service cannot be shut down the way it was with centralized mixers like Sinbad,” Elliptic researchers said.

In August 2022, Tornado Cash was sanctioned by the US Treasury Department, after which Lazarus Group switched to other cryptocurrency mixers, including Sinbad. However, in November 2023, this service was also blacklisted by the US Treasury, which prompted the hacker group to return to Tornado Cash.

American authorities are still conducting legal proceedings against the creators of Tornado Cash, Roman Storm and Alexey Pertsev. The developers are accused of conspiring to conduct unlicensed activities that facilitate money laundering through cryptocurrencies. Last year, Storm was released on bail, and Pertsev was placed under house arrest until the investigation was completed.